diff --git a/components/script/script_runtime.rs b/components/script/script_runtime.rs
index 8d1638dea5f..a1d7c2929db 100644
--- a/components/script/script_runtime.rs
+++ b/components/script/script_runtime.rs
@@ -552,13 +552,16 @@ unsafe extern "C" fn content_security_policy_allows(
parameter_args_vec
.push(TrustedScriptOrString::TrustedScript(trusted_script));
} else {
- unreachable!();
+ // It's not a trusted script but a different object. Treat it
+ // as if it is a string, since we don't need the actual contents
+ // of the object.
+ parameter_args_vec
+ .push(TrustedScriptOrString::String(DOMString::new()));
}
} else if value.is_string() {
- let string_ptr = std::ptr::NonNull::new(value.to_string()).unwrap();
- let dom_string = unsafe { jsstr_to_string(*cx, string_ptr) };
+ // We don't need to know the specific string, only that it is untrusted
parameter_args_vec
- .push(TrustedScriptOrString::String(dom_string.into()));
+ .push(TrustedScriptOrString::String(DOMString::new()));
} else {
unreachable!();
}
diff --git a/tests/wpt/meta/MANIFEST.json b/tests/wpt/meta/MANIFEST.json
index 7c10d47ac30..3a22bd324ad 100644
--- a/tests/wpt/meta/MANIFEST.json
+++ b/tests/wpt/meta/MANIFEST.json
@@ -836283,6 +836283,13 @@
{}
]
],
+ "eval-with-non-trusted-script-object.html": [
+ "455e2620afc496b438e3a221451f260097146349",
+ [
+ null,
+ {}
+ ]
+ ],
"eval-with-permissive-csp.html": [
"b3dc352017675a2634aa96ac1fdea01b55ce9243",
[
diff --git a/tests/wpt/tests/trusted-types/eval-with-non-trusted-script-object.html b/tests/wpt/tests/trusted-types/eval-with-non-trusted-script-object.html
new file mode 100644
index 00000000000..455e2620afc
--- /dev/null
+++ b/tests/wpt/tests/trusted-types/eval-with-non-trusted-script-object.html
@@ -0,0 +1,20 @@
+
+
+
+
+
+
+
+
+
+
+
+